Conventionally, users on a client system have used a combination of a web browser and other client-based applications to access a content file retrieved from a remote location. For example, the user may access Internet content using INTERNET EXPLORER from Microsoft Corporation of Redmond, Wash. and then use WINDOWS EXPLORER also from Microsoft Corporation to access a desktop productivity document type such as a WORD document that has been downloaded to a local location.
The conventional process requires downloading the file to the client node for viewing and manipulation. However, this process presents difficulties from a security standpoint. In order to access the content at the client, twice the user is required to save the content locally to non-volatile memory. The first save is required during download and the second is required post editing prior to the uploading process. Additionally, many users frequently move and/or copy the downloaded content from one local directory to another (e.g.: from dir://downloaded_files to dir://my_documents). Each of these save actions creates a local copy of the document on the client. Very few users of the client device will remember to manually delete these local copies of the documents, which accordingly remain on the client device.
Further, direct manipulation of the client device's storage may be inaccessible to the user, such as the situation where the client device is located in a public kiosk setting. In these cases, the option of deleting the local copy is not available to the user. Since documents left on the client may be accessed by unauthorized individuals with access to the client machine this presents a significant security issue. Additionally, smaller device types, such as personal digital assistants may not have sufficient resources to allow use of client-based applications on the device.
In an attempt to solve these concerns, conventional methods of access control may require particular authentication credentials from the client prior to granting access and may deny access from inappropriate locations or devices. However, a limitation to conventional methods typically requires that the access control decision result in either a denial or a grant of access to a resource. In the event of a denial, the methods fail to provide any alternative methods of access. In the event of a grant, the methods can provide only full and complete disclosure of the resource. A method of granting access control by assigning degrees of access based on access control levels would be desirable in providing access to proprietary resources in a networked environment.
Additionally, in protecting proprietary data from improper client node access, it would be desirable for access rights to provide alternative methods of accessing files, depending upon factors such as the client device type, authorization credentials, and capabilities. An alternative to complete denial of access rights, such as limited rights to files executed on a secure network on behalf of the client, would be desirable.